About 60% of aPriori’s APR airdrop was claimed by a single entity across 14,000 interconnected wallets, according to Bubblemaps.
You might also be interested in reading The attacker behind the May $5.8M TrustedVolumes exploit has returned 1,122 ETH (~$2M).